@yuneta/gobj-ui 7.23.194 → 7.23.196

package/src/table_cell_text.js

@@ -0,0 +1,53 @@
+/****************************************************************************
+ *          table_cell_text.js
+ *
+ *          What a treedb table cell hands Tabulator.
+ *
+ *          Tabulator assigns a formatter's STRING result with `innerHTML`
+ *          (only its own `plaintext` formatter escapes), so a record's text
+ *          returned as a string is parsed as markup: `a<b and c>d` showed
+ *          as `ad`, and a field holding `<img src=x onerror=...>` ran it in
+ *          the operator's browser (M31 of the 2026-09-21 review). Record
+ *          data goes in as a TEXT NODE, and a cell built around it as DOM,
+ *          never as an HTML string with the data interpolated.
+ *
+ *          Pure but for the `document` it is handed, so it is tested
+ *          without one.
+ *
+ *          Copyright (c) 2026, ArtGins.
+ *          All Rights Reserved.
+ ****************************************************************************/
+
+/************************************************************
+ *  A value shown as text, whatever characters it holds
+ ************************************************************/
+function cell_text(value, doc = globalThis.document)
+{
+    if(value === null || value === undefined) {
+        return "";
+    }
+    return doc.createTextNode(String(value));
+}
+
+/************************************************************
+ *  The hook cell, as a createElement2 spec: the row id is an
+ *  attribute VALUE, never text spliced into markup (an id holding
+ *  a `"` cut the attribute and lost the rest of the id)
+ ************************************************************/
+function hook_cell_spec(row_id, col_id, items, title, title_key)
+{
+    return ['a', {
+        class: 'HOOK_CELL hook_cell',
+        title: title,
+        'data-i18n-title': title_key,
+        'aria-label': title,
+        'data-i18n-aria-label': title_key,
+        'data-row_id': String(row_id),
+        'data-col_id': String(col_id)
+    }, [
+        ['span', {class: 'icon yi-eye'}],
+        ['u', {class: 'HOOK_CELL_COUNT'}, `[ ${items} ]`]
+    ]];
+}
+
+export {cell_text, hook_cell_spec};

package/src/table_cell_text.test.js

@@ -0,0 +1,39 @@
+import {describe, it, expect} from "vitest";
+import {cell_text, hook_cell_spec} from "./table_cell_text.js";
+
+/*  A document double: the library has no DOM test (see yui_clipboard.test.js)  */
+const doc = {
+    createTextNode: (text) => ({nodeType: 3, textContent: text})
+};
+
+describe("table_cell_text", () => {
+
+    it("record text is a text node, markup included", () => {
+        /*  M31: Tabulator puts a string through innerHTML  */
+        const node = cell_text("limit a<b and c>d", doc);
+        expect(node.nodeType).toBe(3);
+        expect(node.textContent).toBe("limit a<b and c>d");
+        expect(cell_text('<img src=x onerror=alert(1)>', doc).textContent)
+            .toBe('<img src=x onerror=alert(1)>');
+    });
+
+    it("numbers and booleans are shown as text too, nothing is empty", () => {
+        expect(cell_text(0, doc).textContent).toBe("0");
+        expect(cell_text(false, doc).textContent).toBe("false");
+        expect(cell_text(null, doc)).toBe("");
+        expect(cell_text(undefined, doc)).toBe("");
+    });
+
+    it("the hook cell carries the row id whole, quote included", () => {
+        const spec = hook_cell_spec(
+            'es"madrid', "users", 3, "ver registros enlazados", "show linked records"
+        );
+        expect(spec[0]).toBe("a");
+        expect(spec[1]["data-row_id"]).toBe('es"madrid');
+        expect(spec[1]["data-col_id"]).toBe("users");
+        expect(spec[1].title).toBe("ver registros enlazados");
+        expect(spec[1]["aria-label"]).toBe("ver registros enlazados");
+        expect(spec[1]["data-i18n-title"]).toBe("show linked records");
+        expect(spec[1]["data-i18n-aria-label"]).toBe("show linked records");
+    });
+});